Because of yet another mix-up with bioterror pathogens, a federal terrorism response training center in Alabama says it mistakenly exposed more than 9,600 firefighters, paramedics and other students to a deadly toxin over the past five years.

The Federal Emergency Management Agency’s Center for Domestic Preparedness blames an outside laboratory for a series of shipping errors since 2011 that resulted in the first-responder training center using in its classes a potentially lethal form of ricin powder. The poison, made from castor beans, is capable of killing at small doses.

The training center says it submitted order forms asking for a type of ricin extract that is unlikely to cause serious harm. But officials from Toxin Technology, the Florida company that sent nine shipments to the center since 2011, told USA TODAY that its ricin products were all accurately labeled as “RCA60” – a scientific name for the whole ricin toxin, which can be deadly.

It’s unclear why training center staff didn’t recognize for years that they were working with a far more dangerous substance. There is no antidote to treat ricin poisoning.

Former Homeland Security Secretary Tom Ridge said he’s stunned that over the past five years the training center never verified that it was receiving the less-toxic ricin product it thought it was ordering.

Nobody was sickened by the exposures, FEMA spokeswoman Alexa Lopez said. Students, who were being trained to detect the presence of biological agents, were wearing protective gear during the exercises. Workers at the Anniston, Ala., training center prepared ricin training materials in special biosafety cabinets designed to protect against exposures.

Still Ridge and other national security experts say the ricin mix-up is just the latest high-profile incident showing lax safety practices at U.S. biodefense facilities. Hundreds of government, military, private and university laboratories nationwide possess potential bioterror pathogens, which the government calls “select agents,” such as those that cause anthrax, botulism and plague. They’re used in scientific research and the development of vaccines, medical treatments and for creating and testing detection and personal protection equipment.

In 2014, CDC mistakes with anthrax specimens that were believed to be killed resulted in dozens of the agency’s lab workers being potentially exposed to the deadly bacteria. In 2015, the Pentagon discovered that an Army lab in Utah had been mistakenly shipping live anthrax – labeled as killed – to dozens of labs in the U.S. and abroad for more than a decade.

Richard Ebright, a biosafety expert at Rutgers University, said what happened at the FEMA training facility with ricin is the latest incident in which “incompetence by a federal agency” has resulted in a mix-up between biological specimens that were thought to be killed or inactivated – yet weren’t.

“The only way those running security agencies will get this message in their heads, is if violators are held accountable,” Ebright said. But that hasn’t happened, he said.

A USA TODAY investigation in 2015 found hundreds of safety incidents at labs nationwide and a lax and secretive system of oversight of potential bioterror pathogens that hides serious incidents from the public.

“These kinds of things are continually going to happen until biosafety gets elevated to a major level,” said Amesh Adalja, a senior associate at the UPMC Center for Health Security. While the research done into bioterror pathogens is important, the public’s trust and support for it will be eroded if safety isn’t improved, he said.

Investigators from the Federal Select Agent Program, which regulates labs and other facilities that work with potential bioterror pathogens, traveled this week to the company that supplied the ricin to the FEMA training center. The program is jointly run by the Centers for Disease Control and Prevention and the U.S. Department of Agriculture.

Neither the CDC nor FEMA would name the vendor that supplied the ricin to the training facility when asked by The Anniston Star, which first revealed the incident, nor to USA TODAY. USA TODAY determined through its reporting the vendor was Toxin Technology in Sarasota, Fla.

Information provided to USA TODAY by officials at Toxin Technology and the FEMA training center conflict in several ways and raise significant questions about how ricin materials were ordered and shipped over the years.

FEMA in its statements has repeatedly said the material mix-up was “due to an error by the supplier” and that the “intended use declaration” forms the training center submitted to the vendor specified the center was seeking “Ricin Chain A.”

The ricin toxin has two components, referred to as A and B chains. The B-chain needs to be present, experts said, to allow the A-chain to enter and damage cells. FEMA officials say their intent was to use the A-chain ricin in its programs because it was safer and would still react with detection equipment during training classes as if it were the more dangerous whole ricin toxin.

“In November 2016, while making a purchase of ricin A-chain for training, staff at FEMA’s Center for Domestic Preparedness recognized an ongoing discrepancy in the documentation related to the type of ricin being provided,” FEMA said in a statement. But the agency wouldn’t provide any details about what kind of documentation and discrepancy was involved.

However the ordering catalog for Toxin Technology does not list any A-chain ricin products – only a whole ricin product. FEMA told USA TODAY the product it ordered wasn’t in the company’s catalog. “It was a specialty product rather than a standard catalog item,” the agency said.

Raoul Reiser, who founded Toxin Technology in 1984 and sold it to a partner about three years ago, told USA TODAY that he remembers supplying A-chain ricin products to the FEMA training facility while he was there.

Reiser said that while the A-chain ricin product wasn’t in Toxin Technology’s catalog, it was purchased by many customers as far away as Singapore who learned about it through word of mouth.

“We never made the ricin at Tox Tech, we were just repackaging and reselling what Vector Labs was selling,” Reiser said. He said Toxin Technology would buy the A-chain ricin in liquid form from the international biological supply company, then turn it into a powdered form for resale.

Yet officials at Vector Laboratories told USA TODAY their records show they never sold A-chain ricin to Toxin Technology – only a product that contained the whole ricin toxin.

David Weber, Vector Labs chief commercial officer, said the company checked its records going back to early 2005 and found the only product it shipped to Toxin Technology on numerous occasions through August was a whole ricin product.

Reiser said he was surprised to hear this. “I was under the impression we were buying the A-chain toxin, not the holotoxin,” he said Wednesday night. He said all of the purchasing was handled at Toxin Technology by Paul Bina.

Bina, who is currently listed on Toxin Technology’s website as vice president and lab manager, said he doesn’t know why Reiser would have been under the impression the product sold by the company was A-chain ricin. Bina told USA TODAY that he was at the company when it first started selling ricin products and it sold only two and both were whole toxin products. They were labeled as RCA60 in the company’s catalog, website and “on all shipping and manufacturing records,” he said.

Bina said: “I instructed to purchase the RCA60 from Vector Labs for this purpose. At no time did we ever have Ricin A Chain and at no time did we ever repackage RCA60 and sell it as Ricin A Chain.”

Bina said that when he left the company in 2010 for a few years, the ricin products were still being correctly identified as “RCA60.” When he returned, Bina said the multiple lots of ricin produced while he was away “were still all correctly identified as ‘RCA60’ on all shipping and manufacturing documents.”

After USA TODAY asked FEMA to produce documents showing how the ricin products it received were labeled, the agency called for the inspector general investigation.

Bill Rose, manager of Toxin Technology, said it is company policy not to discuss its clients. But he told USA TODAY on Thursday that the company is in the process of contacting all recipients of its ricin products to ensure they are aware they received the whole toxin products. But he said that a review of the company’s available sales and shipping records show the information sent with the products correctly showed they were “Ricin RCA60.”

Although ricin is a select agent, under federal regulations, it’s exempt from regulation if it is held in amounts less than 100 mg. So while Toxin Technology is regulated by the select agent program, the FEMA training center – which never possessed more than 70 mg of ricin – is not.

“That makes no sense,” said Ridge, who has been co-chairing a Blue Ribbon Study Panel on Biodefense that issued a report calling for strengthening U.S. readiness for bioterrorism and response to emerging disease. The panel, co-chaired by former Senate Homeland Security Committee Chairman Joe Lieberman and sponsored by the Hudson Institute and Potomac Institute for Policy Studies, issued a follow-up report this week noting that Congress still hasn’t done a comprehensive reassessment of the Federal Select Agent Program.